{"id":57271,"date":"2024-05-23T15:48:11","date_gmt":"2024-05-23T15:48:11","guid":{"rendered":"https:\/\/news.talkwithrattan.com\/index.php\/2024\/05\/23\/cloudsek-says-threat-actors-are-spreading-fake-pegasus-spyware\/"},"modified":"2024-05-23T15:48:11","modified_gmt":"2024-05-23T15:48:11","slug":"cloudsek-says-threat-actors-are-spreading-fake-pegasus-spyware","status":"publish","type":"post","link":"https:\/\/news.talkwithrattan.com\/index.php\/2024\/05\/23\/cloudsek-says-threat-actors-are-spreading-fake-pegasus-spyware\/","title":{"rendered":"CloudSEK Says Threat Actors Are Spreading Fake Pegasus Spyware"},"content":{"rendered":"
\"CloudSEK<\/div>


\n<\/p>\n

\n
\n

CloudSEK, a cybersecurity firm, led an investigation after Apple’s threat notifications were sent<\/a> out to iPhone users in 92 countries last month, and found that soon after the advisory was released, the deep and dark web saw a rise of fake Pegasus spyware. Notably, Apple did not name any threat actors in association with its warning, but it did mention Pegasus spyware from the NSO group as an example. CloudSEK believes this could have led to scammers selling fraudulent malware as Pegasus source code.<\/p>\n

Details of CloudSEK’s investigation<\/h2>\n

After Apple’s warning<\/a> in April, CloudSEK researchers began delving into the deep and dark web, as well as the surface web to see whether authentic Pegasus spyware was available to purchase or if fraudsters were using its name to swindle potential buyers. In a report<\/a> titled \u201cBehind the Advisory: Decoding Apple’s Alert and Spyware Dilemma\u201d, the cybersecurity firm stated that it frequented Internet Relay Chat (IRC) platforms. After analysing approximately 25,000 posts on Telegram<\/a>, researchers found that a major portion of the posts claimed to sell authentic Pegasus source code.<\/p>\n

<\/span><\/p>\n

CloudSEK’s investigation in Telegram
Photo Credit: CloudSEK<\/span><\/p>\n

\u00a0<\/p>\n

These sale alert posts followed the same pattern. It used words such as NSO<\/a> Tools and Pegasus to entice buyers. Interacting with more than 150 potential sellers of such \u201cPegasus\u201d spyware, the report found that the samples included source code, live video demonstrations of using the malware, and snapshots of the source code. These were all done with names suggesting Pegasus.<\/p>\n

Researchers also found six unique samples named Pegasus<\/a> HNVC (Hidden Virtual Network Computing) posted on deep web between May 2022 and January 2024, suggesting the proliferation of these samples among threat actors. Similar instances were also found on the surface web.<\/p>\n

CloudSEK’s findings<\/h2>\n

The cybersecurity group eventually obtained 15 samples and more than 30 indicators from various sources. However, it found that \u201cnearly all of them have been creating their own fraudulent, ineffective tools and scripts, attempting to distribute them under Pegasus’ name to capitalise on Pegasus and NSO Group’s name for substantial financial gain.\u201d<\/p>\n

It is believed that groups of bad actors have used the sensationalism created by Apple’s advisory and multiple news reports mentioning the Pegasus name and used it to sell self-created random samples labelled Pegasus. While these spyware can still be nefarious and harm the victims, they are likely not associated with the NSO Group or Pegasus.<\/p>\n

The report has urged critical examination after an incident of a threat attack to correctly attribute the threat actors as it can both help cybersecurity firms in identifying and suggesting reinforcements and will ensure no panic is spread among people.<\/p>\n\n

Affiliate links may be automatically generated – see our ethics statement<\/a> for details.<\/i><\/div>\n<\/div>\n

\n For the latest tech news<\/a> and reviews<\/a>, follow Gadgets 360 on X<\/a>, Facebook<\/a>, WhatsApp<\/a>, Threads<\/a> and Google News<\/a>. For the latest videos on gadgets and tech, subscribe to our YouTube channel<\/a>. If you want to know everything about top influencers, follow our in-house Who’sThat360<\/a> on Instagram<\/a> and YouTube<\/a>. <\/p>\n

\n
\n
\n <\/p>\n
\n \"\"\n <\/div>\n

Google Photos to Reportedly Get New Feature That Turns Videos Into Cinematic Clips<\/span>
\n <\/a>\n <\/div>\n

\n
\n
\n Sam Altman’s OpenAI Signs Content Agreement With News Corp<\/span><\/p>\n
\n \"\"\n <\/div>\n

<\/a>\n <\/div>\n<\/div>\n

<\/p><\/div>\n